Technologies for hybrid field-programmable gate array application-specific integrated circuit code acceleration

ABSTRACT

Technologies for hybrid acceleration of code include a computing device (100) having a processor (120), a field-programmable gate array (FPGA) (130), and an application-specific integrated circuit (ASIC) (132). The computing device (100) offloads a service request, such as a cryptographic request or a packet processing request, to the FPGA (130). The FPGA (130) performs one or more algorithmic tasks of an algorithm to perform the service request. The FPGA (130) determines one or more primitive tasks associated with an algorithm task and encapsulates each primitive task in a buffer that is accessible by the ASIC (132). The ASIC (132) performs the primitive tasks in response to encapsulation in the buffer, and the FPGA (130) returns results of the algorithm. The primitive operations may include cryptographic primitives such as modular exponentiation, modular multiplicative inverse, and modular multiplication. The results may be returned to the processor (120) or a network interface controller of the computing device (100).

CROSS REFERENCE TO RELATED APPLICATIONS

This Application is a continuation of and claims the benefit of andpriority to U.S. application Ser. No. 15/755,216, entitled “TECHNOLOGIESFOR HYBRID FIELD-PROGRAMMABLE GATE ARRAY APPLICATION-SPECIFIC INTEGRATEDCIRCUIT CODE ACCELERATION”, by Ned M. Smith, et al., filed Feb. 26,2018, now U.S. Pat. No. 10,970,119 with an issue date of Apr. 6, 2021,which claims the benefit of and priority to International ApplicationNo. PCT/CN2017/078472, filed Mar. 28, 2017, entitled “TECHNOLOGIES FORHYBRID FIELD-PROGRAMMABLE GATE ARRAY-APPLICATION-SPECIFIC INTEGRATEDCIRCUIT CODE ACCELERATION”, published as WO 2018/176238 on Oct. 4, 2018,the entire contents of which are incorporated herein by reference.

BACKGROUND

Modern computing devices may include general-purpose processor cores aswell as a variety of hardware accelerators for performing specializedtasks. Certain computing devices may include one or morefield-programmable gate arrays (FPGAs), which may include programmabledigital logic resources that may be configured by the end user or systemintegrator. Similarly, computing devices may include one or moreapplication-specific integrated circuits (ASICs), which may provideimproved performance and/or power efficiency compared to an equivalentFPGA. An FPGA may allow for improved flexibility, time-to-market, and/orpower consumption compared to a pure ASIC solution.

BRIEF DESCRIPTION OF THE DRAWINGS

The concepts described herein are illustrated by way of example and notby way of limitation in the accompanying figures. For simplicity andclarity of illustration, elements illustrated in the figures are notnecessarily drawn to scale. Where considered appropriate, referencelabels have been repeated among the figures to indicate corresponding oranalogous elements.

FIG. 1 is a simplified block diagram of at least one embodiment of acomputing device for hybrid code acceleration with a field-programmablegate array and application-specific integrated circuit;

FIG. 2 is a simplified block diagram of at least one embodiment of anenvironment of the computing device of FIG. 1;

FIGS. 3A and 3B are a simplified flow diagram of at least one embodimentof a method for hybrid algorithm acceleration that may be executed bythe computing device of FIGS. 1 and 2;

FIG. 4 is a simplified block diagram of at least one embodiment of thecomputing device of FIGS. 1-2;

FIG. 5 is a simplified block diagram of at least one embodiment of thecomputing device of FIGS. 1-2; and

FIG. 6 is a simplified block diagram of at least one embodiment of thecomputing device of FIGS. 1-2.

DETAILED DESCRIPTION OF THE DRAWINGS

While the concepts of the present disclosure are susceptible to variousmodifications and alternative forms, specific embodiments thereof havebeen shown by way of example in the drawings and will be describedherein in detail. It should be understood, however, that there is nointent to limit the concepts of the present disclosure to the particularforms disclosed, but on the contrary, the intention is to cover allmodifications, equivalents, and alternatives consistent with the presentdisclosure and the appended claims.

References in the specification to “one embodiment,” “an embodiment,”“an illustrative embodiment,” etc., indicate that the embodimentdescribed may include a particular feature, structure, orcharacteristic, but every embodiment may or may not necessarily includethat particular feature, structure, or characteristic. Moreover, suchphrases are not necessarily referring to the same embodiment. Further,when a particular feature, structure, or characteristic is described inconnection with an embodiment, it is submitted that it is within theknowledge of one skilled in the art to effect such feature, structure,or characteristic in connection with other embodiments whether or notexplicitly described. Additionally, it should be appreciated that itemsincluded in a list in the form of “at least one A, B, and C” can mean(A); (B); (C); (A and B); (A and C); (B and C); or (A, B, and C).Similarly, items listed in the form of “at least one of A, B, or C” canmean (A); (B); (C); (A and B); (A and C); (B and C); or (A, B, and C).

The disclosed embodiments may be implemented, in some cases, inhardware, firmware, software, or any combination thereof. The disclosedembodiments may also be implemented as instructions carried by or storedon a transitory or non-transitory machine-readable (e.g.,computer-readable) storage medium, which may be read and executed by oneor more processors. A machine-readable storage medium may be embodied asany storage device, mechanism, or other physical structure for storingor transmitting information in a form readable by a machine (e.g., avolatile or non-volatile memory, a media disc, or other media device).

In the drawings, some structural or method features may be shown inspecific arrangements and/or orderings. However, it should beappreciated that such specific arrangements and/or orderings may not berequired. Rather, in some embodiments, such features may be arranged ina different manner and/or order than shown in the illustrative figures.Additionally, the inclusion of a structural or method feature in aparticular figure is not meant to imply that such feature is required inall embodiments and, in some embodiments, may not be included or may becombined with other features.

Referring now to FIG. 1, an illustrative computing device 100 for hybridcode acceleration includes a processor 120, a field-programmable gatearray (FPGA) 130, and an application-specific integrated circuit (ASIC)132. In use, as described below, the computing device 100 offloads aservice request to the FPGA 130. The service request may be embodied as,for example, an encryption request from the processor 120, a packetprocessing request from the processor 120 and/or a network interfacecontroller, or other service request. The FPGA 130 performs analgorithm, such as a cryptographic algorithm or packet-processingalgorithm, to service the request. While performing the algorithm, theFPGA 130 may offload primitive operations to the ASIC 132. For example,the FPGA 130 may offload cryptographic mathematical operations such asmodular exponentiation, modular multiplicative inverse, modularmultiplication, or other computationally intensive operations. Afterperforming the primitive operations, the FPGA 130 reports the results,for example reporting back to the processor 120. Thus, the computingdevice 100 may perform the requested algorithm with performance andpower efficiency similar to an all-ASIC implementation while stillretaining the flexibility of an all-FPGA implementation. For example,the algorithm logic of the FPGA 130 may be updated to process newcryptographic algorithms, cryptographic modes of operation, or keysizes, to comply with cryptographic regulatory requirements fordifferent countries of the world, to process new packet formats or otherpacket processing algorithms, or with other updated algorithmicoperations. Accordingly, the computing device 100 may provide flexiblesolutions even for constrained devices that include a low-cost ASIC,such as Internet-of-Things (IoT) devices.

The processor 120 may be embodied as any type of processor capable ofperforming the functions described herein. For example, the processor120 may be embodied as a single or multi-core processor(s), digitalsignal processor, microcontroller, or other processor orprocessing/controlling circuit. Similarly, the memory 124 may beembodied as any type of volatile or non-volatile memory or data storagecapable of performing the functions described herein. In operation, thememory 124 may store various data and software used during operation ofthe computing device 100 such operating systems, applications, programs,libraries, and drivers. The memory 124 is communicatively coupled to theprocessor 120 via the I/O subsystem 122, which may be embodied ascircuitry and/or components to facilitate input/output operations withthe processor 120, the memory 124, and other components of the computingdevice 100. For example, the I/O subsystem 122 may be embodied as, orotherwise include, memory controller hubs, input/output control hubs,sensor hubs, firmware devices, communication links (i.e., point-to-pointlinks, bus links, wires, cables, light guides, printed circuit boardtraces, etc.) and/or other components and subsystems to facilitate theinput/output operations. In some embodiments, the I/O subsystem 122 mayform a portion of a system-on-a-chip (SoC) and be incorporated, alongwith the processor 120, the memory 124, and other components of thecomputing device 100, on a single integrated circuit chip.

The data storage device 126 may be embodied as any type of device ordevices configured for short-term or long-term storage of data such as,for example, memory devices and circuits, memory cards, hard diskdrives, solid-state drives, non-volatile flash memory, or other datastorage devices. The computing device 100 may also include acommunications subsystem 128, which may be embodied as any communicationcircuit, device, or collection thereof, capable of enablingcommunications between the computing device 100 and other remote devicesover a computer network (not shown). For example, the communicationssubsystem 128 may be embodied as or otherwise include a networkinterface controller (NIC) for sending and/or receiving network datawith remote devices. The communications subsystem 128 may be configuredto use any one or more communication technology (e.g., wired or wirelesscommunications) and associated protocols (e.g., Ethernet, InfiniBand®,Bluetooth®, Wi-Fi®, WiMAX, 3G, 4G LTE, etc.) to effect suchcommunication.

As shown in FIG. 1, the computing device 100 includes afield-programmable gate array (FPGA) 130. The FPGA 130 may be embodiedas an integrated circuit including programmable digital logic resourcesthat may be configured after manufacture. The FPGA 130 may include, forexample, a configurable array of logic blocks in communication over aconfigurable data interchange. The FPGA 130 may be coupled to theprocessor 120 via a high-speed connection interface such as a peripheralbus (e.g., a PCI Express bus) or an inter-processor interconnect (e.g.,an in-die interconnect (IDI) or QuickPath Interconnect (QPI)), via afabric interconnect such as Intel® Omni-Path Architecture, or via anyother appropriate interconnect. The computing device 100 furtherincludes an application-specific integrated circuit (ASIC) 132. The ASIC132 may be embodied as any digital logic, functional block, or otherprocessing circuit capable of performing one or more predeterminedoperations. For example, the ASIC 132 may be configured to perform oneor more primitive mathematical operations useful for cryptographicoperations, such as modular exponentiation, modular multiplicativeinverse, modular multiplication, elliptic curve cryptography (ECC)operations, zero-knowledge proof of knowledge, digital random numbergeneration, or other operations. As another example, the ASIC 132 may beconfigured to perform one or more signal processing operations such as afast Fourier transform (FFT) operations. The FPGA 130 and the ASIC 132may be capable of communicating data via a high-speed connectioninterface such as PCI express, QPI, or other interconnect. In someembodiments, the FPGA 130 and the ASIC 132 may be capable ofcommunicating via one or more common direct memory access (DMA) buffers.Additionally, although illustrated in FIG. 1 as discrete componentsseparate from the processor 120 and/or the I/O subsystem 122, it shouldbe understood that in some embodiments one or more of the FPGA 130, theASIC 132, the processor 120, the I/O subsystem 122, and/or the memory124 may be incorporated in the same package and/or in the same computerchip, for example in the same SoC. As another example, in someembodiments the FPGA 130 and the ASIC 132 may be included together in ahybrid offload engine.

The computing device 100 may further include one or more peripheraldevices 134. The peripheral devices 134 may include any number ofadditional input/output devices, interface devices, and/or otherperipheral devices. For example, in some embodiments, the peripheraldevices 134 may include a touch screen, graphics circuitry, a graphicalprocessing unit (GPU) and/or processor graphics, an audio device, amicrophone, a camera, a keyboard, a mouse, a network interface, and/orother input/output devices, interface devices, and/or peripheraldevices.

Referring now to FIG. 2, in an illustrative embodiment, the computingdevice 100 establishes an environment 200 during operation. Theillustrative environment 200 includes an offload manager 202, algorithmlogic 204, primitive offload logic 206, result logic 208, and primitivelogic 210. The various components of the environment 200 may be embodiedas hardware, firmware, software, or a combination thereof. As such, insome embodiments, one or more of the components of the environment 200may be embodied as circuitry or collection of electrical devices (e.g.,offload manager circuitry 202, algorithm logic circuitry 204, primitiveoffload logic circuitry 206, result logic circuitry 208, and/orprimitive logic circuitry 210). It should be appreciated that, in suchembodiments, one or more of the offload manager circuitry 202, thealgorithm logic circuitry 204, the primitive offload logic circuitry206, the result logic circuitry 208, and/or the primitive logiccircuitry 210 may form a portion of the processor 120, the I/O subsystem122, the FPGA 130, the ASIC 132, and/or other components of thecomputing device 100. Additionally, in some embodiments, one or more ofthe illustrative components may form a portion of another componentand/or one or more of the illustrative components may be independent ofone another.

The offload manager 202 is configured to offload a service request tothe FPGA 130 of the computing device 100. In some embodiments, theservice request may be offloaded from the processor 120 to the FPGA 130and/or from a network interface controller of the computing device 100to the FPGA 130. The service request may be embodied as, for example, acryptographic service request, a packet processing service request,and/or a telecommunications service request.

The algorithm logic 204 is configured to perform one or more algorithmtasks of an algorithm to perform the service request. The algorithm maybe embodied as, for example, a cryptographic algorithm or acryptographic mode of operation, a packet processing algorithm such as aTCP/IP packet processing algorithm, or a modulation-demodulationalgorithm. The algorithm logic 204 is further configured to determineone or more primitive tasks associated with the algorithm tasks. Thealgorithm logic 204 may be further configured to determine the one ormore algorithm tasks of the algorithm in response to the service requestbeing offloaded.

The primitive offload logic 206 is configured to encapsulate eachprimitive task in a buffer of the FPGA 130. The buffer is accessible bythe ASIC 132 of the computing device. In some embodiments, the primitiveoffload logic 206 may include load balancing/failover logic that isconfigured to load-balance multiple primitive tasks among multiplecomputation resources of the ASIC 132 (e.g., multiple bit streams) ormultiple ASICs 132. In some embodiments, the load balancing/failoverlogic may be configured to determine resources of the ASIC 132 areunavailable and, if so, perform the primitive task with resources of theFGPA 130.

The result logic 208 is configured to return one or more results of theservice request in response performance of the one or more algorithmtasks and performance of the primitive task by the ASIC 132. Returningthe results may include returning the results from the FPGA 130 to theprocessor 120 and/or forwarding the results from the FPGA 130 to anetwork interface controller of the computing device 100. As shown, thealgorithm logic 204, the primitive offload logic 206, and the resultlogic 208 are established by the FPGA 130.

The primitive logic 210 is configured to perform a primitive task inresponse to encapsulation of the primitive task. The primitive logic 210may perform a cryptographic mathematical primitive operation such as amodular exponentiation operation, a modular multiplicative inverseoperation, a modular multiplication operation, and/or an elliptic curveoperation. In some embodiments, the primitive logic 210 may perform asignal processing operation such as a fast Fourier transform operation.In some embodiments, the primitive logic 210 may perform azero-knowledge proof operation or a digital random number generationoperation. As shown, the primitive logic 210 is established by the ASIC132. In some embodiments, the primitive logic 210 may include multiplebit streams that are each configured to perform a particular primitivetask. The primitive logic 210 may include multiple bit streams that arecapable of performing the same primitive task in parallel.

Referring now to FIGS. 3A and 3B, in use, the computing device 100 mayexecute a method 300 for hybrid code acceleration with an FPGA and anASIC. It should be appreciated that, in some embodiments, the operationsof the method 300 may be performed by one or more components of theenvironment 200 of the computing device 100 as shown in FIG. 2. Themethod 300 begins in block 302, in which the computing device 100receives a service request. The service request may be embodied as anytask, process, or other algorithm that should be performed by thecomputing device 100. In some embodiments, in block 304, the processor120 may receive a cryptographic request. The cryptographic request maybe embodied as any request to perform encryption, decryption, messageauthentication, or other cryptographic operation. The request mayoriginate from application software, operating system software, and/orhardware of the computing device 100. For example, the computing device100 may generate the cryptographic request to encrypt or decrypt networkpacket data.

In some embodiments, in block 306, the computing device 100 may receivea packet processing request. The packet processing request may beembodied as any request to send, receive, or otherwise communicatenetwork packets using the communication subsystem 128. For example, thepacket processing request may be embodied as a request to send one ormore TCP/IP network packets. In some embodiments, the packet processingrequest may also include a request to encrypt or decrypt the packetdata, such as a request to transmit IPsec encrypted packets and/or TLSencrypted packets. In some embodiments, in block 308 a network interfacecontroller (NIC) of the computing device 100 may receive network packetsfor processing. For example, the NIC may receive TCP/IP traffic from oneor more remote computing devices. The network traffic may includeencrypted data, such as IPsec encrypted traffic and/or TLS encryptedtraffic. The NIC may be included in or otherwise embodied as thecommunication subsystem 128.

In some embodiments, in block 310, the processor 120 may receive atelecommunications service request. For example, in some embodiments theprocessor 120 may receive a request to modulate a data stream to acarrier signal and/or to demodulate a carrier signal to a data stream.

In block 312, the computing device 100 offloads the service request tothe FPGA 130. The computing device 100 may use any appropriate techniqueto offload the service request to the FPGA 130. For example, thecomputing device 100 may perform one or more direct memory access (DMA)operations to transfer data relating to the service request into aninternal memory buffer of the FPGA 130. The data may be transferred viaa high-speed connection interface such as PCI Express or QPI. In someembodiments, the computing device 100 may use a notification ring tonotify the FPGA 130 of the service request. The notification ring may beembodied as a ring buffer accessible to the FPGA 130 that includes oneor more pointers, descriptors, or other data indicative of the servicerequest. The service request may be offloaded by the component thatreceived the service request such as the processor 120 or the NIC. Insome embodiments, in block 314, the processor 120 may offload acryptographic request to the FPGA 130. In some embodiments, in block316, the processor 120 may offload a packet processing request to theFPGA 130. For example, the processor 120 may offload a request totransmit certain data to a remote host. In some embodiments, in block318 the NIC may provide network traffic to the FPGA 130. For example,the NIC may transfer network traffic data received from a remote hostdirectly to a buffer of the FPGA 130.

In block 320, the FPGA 130 may perform one or more initialization tasksto perform the service request. The FPGA 130 may perform any tasksrequired to complete the service request, including initializingcomponents of the FPGA 130 and/or the ASIC 132. In some embodiments, inblock 322 the FPGA 130 may decode one or more algorithmic tasks for theservice request. The FPGA 130 may, for example, identify an algorithm tocomplete the service request, including particular tasks to be performedby the FPGA 130 as well as particular primitive operations to beperformed by the ASIC 132 to perform the algorithm, as described furtherbelow. In some embodiments, in block 324 the FPGA 130 may initialize oneor more DMA buffers. The DMA buffers may receive data from the processor120 and/or the NIC for processing. The DMA buffers may also beaccessible to the ASIC 132 for processing primitive operations.

In block 326, shown in FIG. 3B, the FPGA 130 performs one or morealgorithmic tasks for the service request. The algorithmic tasks may beembodied as any sequence or set of logical, computational, or othertasks that are executed by the FPGA 130 to perform the service request.The algorithmic tasks may include algorithm logic, pre-computed values,math operations that are not calculation-intensive, and/or other tasksrequired by a particular algorithm. As described further below, eachalgorithmic task may call or otherwise depend on one or more primitivetasks, which are executed by the ASIC 132 as described below. Becausethe algorithmic tasks are performed by the FPGA 130 and not the ASIC132, the overall algorithm and the algorithmic tasks may be more easilymodified than the primitive tasks performed by the ASIC 132. In someembodiments, in block 328 the FPGA 130 may perform cryptographic tasksfor a cryptographic algorithm. For example, the FPGA 130 may perform acryptographic operation (e.g., encryption, decryption, verification,etc.) using a particular cryptographic algorithm or a particular mode ofoperation of the cryptographic algorithm. In some embodiments, in block330 the PGA 130 may perform packet processing tasks. For example, theFPGA 130 may perform the operations of a TCP/IP networking stack, suchas packet encapsulation and de-encapsulation, packet fragmentation andde-fragmentation, packet filtering, or other TPC/IP operations.

In block 332, the FPGA 130 determines whether to offload a primitiveoperation to the ASIC 132. As described below, a primitive operation maybe offloaded in order to complete an algorithmic task or otherwiseperform the service request. For example, an algorithmic task mayinclude performance of the primitive operation, may depend on results ofthe primitive operation, or otherwise may have a dependency on theprimitive operation. If the FPGA 130 determines not to offload aprimitive operation, the method 300 loops back to block 326 to continueprocessing the algorithmic tasks with the FPGA 130. If the FPGA 130determines to offload the primitive operation, the method 300 advancesto block 334.

In block 334, the FPGA 130 determines the primitive operation to beperformed for the algorithmic task. The primitive operation may beembodied as any operation performed by the ASIC 132 that is requested bythe FPGA 130 to perform the algorithm. For example, the primitiveoperation may be embodied as a mathematically intensive operation thatis part of a cryptographic algorithm, signal-processing algorithm, orother algorithm. In block 336, the FPGA 130 encapsulates a primitiverequest to the ASIC 132. The primitive request may be embodied as datathat identifies the requested primitive operation as well as anyassociated data to be processed by the primitive operation. Theprimitive request may be communicated to the ASIC 132 using a high-speedconnection interface, a shared DMA buffer, or other communicationtechnique. For example, in some embodiments the FPGA 130 may use anotification ring to notify the ASIC 132 of primitive requests. The FPGA130 may, for example, store the primitive request or data indicative ofthe primitive request in the notification ring. The ASIC 132 may thenread the primitive request from the notification ring.

In block 338, the ASIC 132 performs the requested primitive operation.The requested primitive operation may be embodied as a mathematicaloperation or other computationally intensive operation performed by theASIC 132. The primitive operation may be used by multiple differentalgorithms, thus allowing the ASIC 132 to be reused without modificationfor new algorithms or updated algorithms. The ASIC 132 may perform theprimitive operation on data included in a shared DMA buffer of the FPGA130 and/or in the main memory 124 of the computing device 100.Similarly, the ASIC 132 may write output data into the shared DMA bufferof the FPGA 130 and/or the memory 124. The ASIC 132 may perform one ormore DMA operations to read input data and/or write output data. Aftercompleting the primitive operation, the ASIC 132 may signal to the FPGA130 that the primitive operation is complete using a notification ring.As described above, the ASIC 132 may perform a computationally intenseoperation useful for cryptographic algorithms, packet processingalgorithms, telecommunication algorithms, or other algorithms. In someembodiments, in block 340, the ASIC 132 may perform a modularexponentiation operation. In some embodiments, in block 342, the ASIC132 may perform a modular multiplicative inverse operation. In someembodiments, in block 344, the ASIC 132 may perform a modularmultiplication operation. In some embodiments, in block 346, the ASIC132 may perform a fast Fourier transform (FFT) operation. The FFToperation may be used, for example, by a modulation-demodulationalgorithm used to perform a telecom service request. In someembodiments, in block 348, the ASIC 132 may perform an elliptic curvecryptography (ECC) operation.

In block 350, the FPGA 130 determines whether the algorithm is complete.The FPGA 130 may determine, for example, whether additional algorithmictasks remain and/or whether the ASIC 132 has completed all offloadedprimitive tasks. If the algorithm is not complete, the method 300 loopsback to block 326 to continue processing the algorithm. If the algorithmis complete, the method 300 advances to block 352.

In block 352, the FPGA 130 returns the results of the service request.The computing device 100 may use any appropriate technique to return theresults from the FPGA 130. For example, the computing device 100 mayperform one or more DMA operations to transfer results data for theservice request from an internal memory buffer of the FPGA 130. The datamay be transferred via a high-speed connection interface such as PCIExpress or QPI. In some embodiments, the FPGA 130 may use a notificationring to notify another component (e.g., the processor 120 or the NIC) ofthe results. The results may be returned to the component that offloadedthe service request or to a different component. In some embodiments, inblock 354 the FPGA 130 may return results to the processor 120. Forexample, the FPGA 130 may return results of a cryptographic servicerequest to the processor 120. As another example, the FPGA 130 mayprovide processed network data (which may be decrypted) received from aremote host to the processor 120. In some embodiments, in block 356 theFPGA 130 may forward one or more data packets (which may be encrypted)to the NIC for transmission to a remote host. After returning theresults of the service request, the method 300 loops back to block 302,shown in FIG. 3A, to process additional service requests.

Referring now to FIG. 4, diagram 400 illustrates one potentialembodiment of the computing device 100 for performing cryptographicacceleration. As shown, the computing device 100 includes the processor120, the FPGA 130, and the ASIC 132. Illustratively, the processor 120is coupled to the FPGA 130 via a QuickPath interconnect (QPI)connection, and the FPGA 130 is coupled to the ASIC 132 via a PCIExpress 3.0 connection. The FPGA 130 includes a host interface 402 andcryptographic algorithm logic 404. The host interface 402 communicateswith the processor 120 and may include a ring bundle and direct memoryaccess (DMA) buffers. The host interface 402 may, for example, receiveoffloaded cryptographic service requests from the processor 120 andprovide results of the cryptographic service requests to the processor120. The cryptographic algorithm logic 404 performs algorithmic tasksfor a cryptographic algorithm such as ECDSA, SM2, SM4, or othercryptographic algorithm. The cryptographic algorithm logic 404 may beupdated for newly published or updated cryptographic algorithms. Asshown, the cryptographic algorithm logic 404 may perform the functionsof the algorithm logic 204 and the host interface 402 may perform thefunctions of the result logic 208.

The ASIC 132 includes a shared RAM and slice controller 406 and multipleprimitive logic 210 components. In particular, the ASIC 132 includesmodular exponentiation logic 408, modular multiplicative inverse logic410, modular multiplication logic 412, and fast Fourier transform. (FFT)logic 414. The shared RAM and slice controller 406 may include databuffers shared between the primitive logic 210 components and mayotherwise control the flow of data between the FPGA 130 and the ASIC132. As described above, the primitive logic 210 components (e.g., themodular exponentiation logic 408, the modular multiplicative inverselogic 410, and/or the modular multiplication logic 412) may be called bythe cryptographic algorithm logic 404 to perform computationallyintensive operations included in the cryptographic algorithm. As shown,the ASIC 132 may also be capable of other primitive operations not usedfor the cryptographic algorithm (e.g., the FFT logic 414). As shown inFIG. 4, input data and results data may be copied or otherwisetransferred between the processor 120, the FPGA 130, and/or the ASIC132. In some embodiments, data may be stored in one or more DMA buffersshared by the processor 120, the FPGA 130, and/or the ASIC 132.

Referring now to FIG. 5, diagram 500 illustrates one potentialembodiment of the computing device 100 for performing inline IPsecprocessing. As shown, the computing device 100 includes the processor120, the communication subsystem 128, the FPGA 130, and the ASIC 132.Illustratively, the processor 120 is coupled to the FPGA 130 via aQuickPath Interconnect (QM) connection, the communication subsystem 128(i.e., a network interface controller of the communication subsystem128) is coupled to the processor 120 and the FPGA 130 via PCI Express3.0 connections, and the FPGA 130 is coupled to the ASIC 132 via a PCIExpress 3.0 connection. The FPGA 130 includes a host interface 502 andcryptographic/telcom logic 504. The host interface 502 communicates withthe processor 120 and the communication subsystem 128, and may include aring bundle and direct memory access (DMA) buffers. The host interface502 may, for example, receive network data for transmission from theprocessor 120 and forward encrypted network data to communicationsubsystem 128. As another example, the host interface 502 may receiveencrypted network traffic from the communication subsystem 128 andforward decrypted network data to the processor 120. Thecryptographic/telcom logic 504 performs packet processing tasksincluding inline IPsec data encryption. In particular, thecryptographic/telcom logic 504 may perform IP packetfragmentation/de-fragmentation and then perform IPsec encryption ordecryption. As shown, the cryptographic/telcom logic 504 may perform thefunctions of the algorithm logic 204 and the host interface 502 mayperform the functions of the result logic 208.

Similar to the ASIC 132 shown in FIG. 4, the ASIC 132 of FIG. 5 includesa shared RAM and slice controller 506 and multiple primitive logic 210components. In particular, the ASIC 132 includes modular exponentiationlogic 508, modular multiplicative inverse logic 510, modularmultiplication logic 512, and fast Fourier transform (FFT) logic 514.The shared RAM and slice controller 506 may include data buffers sharedbetween the primitive logic 210 components and may otherwise control theflow of data between the FPGA 130 and the ASIC 132. As described above,the primitive logic 210 components (e.g., the modular exponentiationlogic 508, the modular multiplicative inverse logic 510, and/or themodular multiplication logic 512) may be called by thecryptographic/telcom logic 504 to perform computationally intensiveoperations during inline IPsec packet processing. As shown, the ASIC 132may also be capable of other primitive operations not used for IPsecpacket processing (e.g., the FFT logic 514, which may be used for amodulation-demodulation algorithm). As shown in FIG. 5, input data andresults data may be copied or otherwise transferred between theprocessor 120, the communication subsystem 128, the FPGA 130, and/or theASIC 132. In some embodiments, data may be stored in one or more DMAbuffers shared by the processor 120, the communication subsystem 128,the FPGA 130, and/or the ASIC 132.

Referring now to FIG. 6, diagram 600 illustrates one potentialembodiment of the computing device 100 for performing inline TLSprocessing. As shown, the computing device 100 includes the processor120 coupled to the memory 124. The processor 120 is further coupled toan internal DMA buffer 602 that is common to the FPGA 130 and acryptographic processor 606. The illustrative cryptographic processor606 includes multiple instances of a cryptographic ASIC 132. Eachcryptographic ASIC 132 may perform cryptographic primitive operationssuch as modular exponentiation, modular multiplicative inverse, andmodular multiplication, similar to the ASICS 132 shown in FIGS. 4 and 5.The cryptographic processor 606 further includes a hardware securitymodule 608, which may be embodied as a hardened or otherwisetamper-resistant component for security key management and storage. Forexample, the hardware security module 608 may be embodied as a convergedsecurity and manageability engine (CSME), a trusted platform module(TPM), a secure enclave created using Intel® SGX, or other trustedexecution environment of the computing device 100. As shown, theprocessor 120 may communicate with the FPGA 130 using a notificationring NR0 604, and the FPGA 130 may communicate with the cryptographicASICs 132 using a notification ring NR1 610. Each of the notificationrings 604, 610 may be embodied as a ring buffer in the internal DMAbuffer 602 that may be used to transfer pointers, descriptors, or otherdata encapsulating requests and associated data between the processor120, the FPGA 130, and the ASICs 132. As shown, the FPGA 130 furtherincludes TCP/IP logic 612 and failover/load balance logic 614. TheTCP/IP logic 612 provides a TCP/IP stack for processing incoming andoutgoing data. In particular, the TCP/IP logic 612 performs TCP/IPprocessing for network data received from the processor 120 and providedto the communication subsystem 128 for transmission to remote hosts aswell as TCP/IP processing for network data from other hosts receivedfrom the communication subsystem 128 and provided to the processor 120.The failover/load balance logic 614 offloads cryptographic operations tothe cryptographic ASICs 132 to provide inline TIS encryption anddecryption. The failover/load balance logic 614 may coordinate andbalance utilization of the ASICs 132, which may allow the computingdevice 100 to scale with the number of processor 120 threads dedicatedto TLS offload. For example, the ASICs 132 may include multipleinstances of the same type of offload bit streams so that multipleinstances of the same operation (e.g., modular multiplicationoperations, zero-knowledge proofs, etc.) may be performed in parallelusing the multiple bit streams. In some embodiments, the FPGA 130 mayimplement additional offload hit streams that may be used only when thebit streams resources of the ASICs are busy or otherwise unavailable. Asshown, in some embodiments the internal DMA buffer 602, thecryptographic processor 606 and the FPGA 130 may be included in a hybridoffload engine 616.

In use, the communication subsystem 128 may receive network packet datafrom a remote host and provide the network packet data directly to theFPGA 130. The TCP/IP logic 612 of the FPGA 130 processes the incomingnetwork packet data, and after being processed, the packet data isstored in the internal DMA buffer 602. The FPGA 130 determines whethercryptographic operations are required for the network packet data. Ifnot, the FPGA 130 notifies the processor 120 of the new network packetdata using the notification ring NR0 604. In response, the processor 120retrieves the network packet data from the internal DMA buffer 602 usinga PCI Express transaction. If the FPGA 130 determines that cryptographicoperations are required for the network packet data, the FPGA 130 sendsa notification to the cryptographic ASICs 132 using the notificationring NR1 610. The failover/load balancing logic 614 may select a targetcryptographic ASIC 132 based on a failover/load balancing policy. Inresponse to the notification, the cryptographic ASIC 132 retrieves theinput data from the internal DMA buffer 602. The cryptographic ASIC 132may also retrieve secret keys or other sensitive data from the hardwaresecurity module 608. After retrieving the input data and any requiredkeys, the cryptographic ASIC 132 performs the requested cryptographicoperation and pushes the processed data hack into the internal DMAbuffer 602. Thus, the ASIC 132 may perform inline encryption byreplacing plaintext with cipher text in the network frame or inlinedecryption by replacing cipher text with plaintext in the network frame.The cryptographic ASIC 132 notifies the FPGA 130 that the operation iscomplete using the notification ring NR1 610. After receiving thenotification, the FPGA 130 notifies the processor 120 and the processor120 may retrieve the processed data as described above.

It should be appreciated that, in some embodiments, the method 300 maybe embodied as various instructions stored on a computer-readable media,which may be executed by the processor 120, the FPGA 130, the ASIC 132,and/or other components of the computing device 100 to cause thecomputing device 100 to perform the method 300. The computer-readablemedia may be embodied as any type of media capable of being read by thecomputing device 100 including, but not limited to, the memory 124, thedata storage device 126, firmware devices, other memory or data storagedevices of the computing device 100, portable media readable by aperipheral device 134 of the computing device 100, and/or other media.

EXAMPLES

Illustrative examples of the technologies disclosed herein are providedbelow. An embodiment of the technologies may include any one or more,and any combination of, the examples described below.

Example 1 includes a computing device for algorithm acceleration, thecomputing device comprising: a field-programmable gate array (FPGA); anapplication-specific integrated circuit (ASIC); and an offload managerto offload a service request to the FPGA of the computing device;wherein the FPGA comprises: algorithm logic to (i) perform one or morealgorithm tasks of an algorithm to perform the service request and (ii)determine a primitive task associated with an algorithm task; primitiveoffload logic to encapsulate the primitive task in a buffer of the FPGA,wherein the buffer is accessible by the ASIC of the computing device;and result logic to return one or more results of the service request inresponse to performance of the one or more algorithm tasks andperformance of the primitive task by the ASIC; and wherein the ASICcomprises primitive logic to perform the primitive task in response toencapsulation of the primitive task.

Example 2 includes the subject matter of Example 1, and wherein theservice request comprises a cryptographic service request and thealgorithm comprises a cryptographic algorithm.

Example 3 includes the subject matter of any of Examples 1 and 2, andwherein the cryptographic algorithm comprises a cryptographic mode ofoperation.

Example 4 includes the subject matter of any of Examples 1-3, andwherein the service request comprises a packet processing servicerequest and the algorithm comprises a packet processing algorithm.

Example 5 includes the subject matter of any of Examples 1-4, andwherein the packet processing algorithm comprises a TCP/IP packetprocessing algorithm.

Example 6 includes the subject matter of any of Examples 1-5, andwherein the service request comprises a telecommunications servicerequest and the algorithm comprises a modulation-demodulation algorithm.

Example 7 includes the subject matter of any of Examples 1-6, andwherein to offload the service request comprises to offload the servicerequest from a processor of the computing device to the FPGA.

Example 8 includes the subject matter of any of Examples 1-7, andwherein to offload the service request comprises to offload the servicerequest from a network interface controller of the computing device tothe FPGA.

Example 9 includes the subject matter of any of Examples 1-8, andwherein the algorithm logic is further to determine the one or morealgorithm tasks of the algorithm in response to an offload of theservice request.

Example 10 includes the subject matter of any of Examples 1-9, andwherein to perform the primitive task comprises to perform acryptographic mathematical primitive operation.

Example 11 includes the subject matter of any of Examples 1-10, andwherein the primitive task comprises a modular exponentiation operation.

Example 12 includes the subject matter of any of Examples 1-11, andwherein the primitive task comprises a modular multiplicative inverseoperation.

Example 13 includes the subject matter of any of Examples 1-12, andwherein the primitive task comprises a modular multiplication operation.

Example 14 includes the subject matter of any of Examples 1-13, andwherein the primitive task comprises an elliptic curve operation.

Example 15 includes the subject matter of any of Examples 1-14, andwherein to perform the primitive task comprises to perform a signalprocessing operation.

Example 16 includes the subject matter of any of Examples 1-15, andwherein the primitive task comprises a fast Fourier transform operation.

Example 17 includes the subject matter of any of Examples 1-16, andwherein to perform the primitive task comprises to perform azero-knowledge proof operation.

Example 18 includes the subject matter of any of Examples 1-17, andwherein to perform the primitive task comprises to perform a digitalrandom number generation operation.

Example 19 includes the subject matter of any of Examples 1-18, andwherein: the primitive logic of the ASIC comprises a plurality of bitstreams, wherein each bit stream is configured to perform the primitivetask; and the primitive offload logic of the FPGA is to load-balance aplurality of primitive tasks among the plurality of bit streams of theASIC.

Example 20 includes the subject matter of any of Examples 1-19, andwherein the primitive offload logic of the FPGA is to (i) determinewhether the plurality of bit streams of the ASIC are unavailable and(ii) perform the primitive task in response to a determination that theplurality of bit streams of the ASIC are unavailable.

Example 21 includes the subject matter of any of Examples 1-20, andwherein to return the one or more results of the service requestcomprises to return the results from the FPGA to a processor of thecomputing device.

Example 22 includes the subject matter of any of Examples 1-21, andwherein to return the one or more results of the service requestcomprises to forward the results from the FPGA to a network interfacecontroller of the computing device.

Example 23 includes a method for algorithm acceleration, the methodcomprising: offloading, by a computing device, a service request to afield-programmable gate array (FPGA) of the computing device;performing, by the FPGA of the computing device, one or more algorithmtasks of an algorithm to perform the service request; determining, bythe FPGA of the computing device, a primitive task associated with analgorithm task; encapsulating, by the FPGA of the computing device, theprimitive task in a buffer of the FPGA, wherein the buffer is accessibleby an application-specific integrated circuit (ASIC) of the computingdevice; performing, by the ASIC, the primitive task in response toencapsulating the primitive task; and returning, by the FPGA, one ormore results of the service request in response to performing the one ormore algorithm tasks and performing the primitive task.

Example 24 includes the subject matter of Example 23, and wherein theservice request comprises a cryptographic service request and thealgorithm comprises a cryptographic algorithm.

Example 25 includes the subject matter of any of Examples 23 and 24, andwherein the cryptographic algorithm comprises a cryptographic mode ofoperation.

Example 26 includes the subject matter of any of Examples 23-25, andwherein the service request comprises a packet processing servicerequest and the algorithm comprises a packet processing algorithm.

Example 27 includes the subject matter of any of Examples 23-26, andwherein the packet processing algorithm comprises a TCP/IP packetprocessing algorithm.

Example 28 includes the subject matter of any of Examples 23-27, andwherein the service request comprises a telecommunications servicerequest and the algorithm comprises a modulation-demodulation algorithm.

Example 29 includes the subject matter of any of Examples 23-28, andwherein offloading the service request comprises offloading the servicerequest from a processor of the computing device to the FPGA.

Example 30 includes the subject matter of any of Examples 23-29, andwherein offloading the service request comprises offloading the servicerequest from a network interface controller of the computing device tothe FPGA.

Example 31 includes the subject matter of any of Examples 23-30, andfurther comprising determining, by the FPGA of the computing device, theone or more algorithm tasks of the algorithm in response to offloadingthe service request.

Example 32 includes the subject matter of any of Examples 23-31, andwherein performing the primitive task comprises performing acryptographic mathematical primitive operation.

Example 33 includes the subject matter of any of Examples 23-32, andwherein performing the primitive task comprises performing a modularexponentiation operation.

Example 34 includes the subject matter of any of Examples 23-33, andwherein performing the primitive task comprises performing a modularmultiplicative inverse operation.

Example 35 includes the subject matter of any of Examples 23-34, andwherein performing the primitive task comprises performing a modularmultiplication operation.

Example 36 includes the subject matter of any of Examples 23-35, andwherein performing the primitive task comprises performing an ellipticcurve operation.

Example 37 includes the subject matter of any of Examples 23-36, andwherein performing the primitive task comprises performing a signalprocessing operation.

Example 38 includes the subject matter of any of Examples 23-37, andwherein performing the primitive task comprises performing a fastFourier transform operation.

Example 39 includes the subject matter of any of Examples 23-38, andwherein performing the primitive task comprises performing azero-knowledge proof operation.

Example 40 includes the subject matter of any of Examples 23-39, andwherein performing the primitive task comprises performing a digitalrandom number generation operation.

Example 41 includes the subject matter of any of Examples 23-40, andfurther comprising load-balancing, by the FGPA, a plurality of primitivetasks among a plurality of bit streams of the ASIC, wherein each bitstream of the ASIC is configured to perform the primitive task.

Example 42 includes the subject matter of any of Examples 23-41, andfurther comprising: determining, by the FPGA, whether the plurality ofbit streams of the ASIC are unavailable; and performing, by the FGPA,the primitive task in response to determining that the plurality of bitstreams of the ASIC are unavailable.

Example 43 includes the subject matter of any of Examples 23-42, andwherein returning the one or more results of the service requestcomprises returning the results from the FPGA to a processor of thecomputing device.

Example 44 includes the subject matter of any of Examples 23-43, andwherein returning the one or more results of the service requestcomprises forwarding the results from the FPGA to a network interfacecontroller of the computing device.

Example 45 includes a computing device comprising: a processor; and amemory having stored therein a plurality of instructions that whenexecuted by the processor cause the computing device to perform themethod of any of Examples 23-44.

Example 46 includes one or more machine readable storage mediacomprising a plurality of instructions stored thereon that in responseto being executed result in a computing device performing the method ofany of Examples 23-44.

Example 47 includes a computing device comprising means for performingthe method of any of Examples 23-44.

Example 48 includes a computing device for algorithm acceleration, thecomputing device comprising: means for offloading a service request to afield-programmable gate array (FPGA) of the computing device; means forperforming, by the FPGA, one or more algorithm tasks of an algorithm toperform the service request; means for determining, by the FPGA, aprimitive task associated with an algorithm task; means forencapsulating, by the FPGA, the primitive task in a buffer of the FPGA,wherein the buffer is accessible by an application-specific integratedcircuit (ASIC) of the computing device; means for performing, by theASIC, the primitive task in response to encapsulating the primitivetask; and means for returning, by the FPGA, one or more results of theservice request in response to performing the one or more algorithmtasks and performing the primitive task.

Example 49 includes the subject matter of Example 48, and wherein theservice request comprises a cryptographic service request and thealgorithm comprises a cryptographic algorithm.

Example 50 includes the subject matter of any of Examples 48 and 49, andwherein the cryptographic algorithm comprises a cryptographic mode ofoperation.

Example 51 includes the subject matter of any of Examples 48-50, andwherein the service request comprises a packet processing servicerequest and the algorithm comprises a packet processing algorithm.

Example 52 includes the subject matter of any of Examples 48-51, andwherein the packet processing algorithm comprises a TCP/IP packetprocessing algorithm.

Example 53 includes the subject matter of any of Examples 48-52, andwherein the service request comprises a telecommunications servicerequest and the algorithm comprises a modulation-demodulation algorithm.

Example 54 includes the subject matter of any of Examples 48-53, andwherein the means for offloading the service request comprises means foroffloading the service request from a processor of the computing deviceto the FPGA.

Example 55 includes the subject matter of any of Examples 48-54, andwherein the means for offloading the service request comprises means foroffloading the service request from a network interface controller ofthe computing device to the FPGA.

Example 56 includes the subject matter of any of Examples 48-55, andfurther comprising means for determining, by the FPGA, the one or morealgorithm tasks of the algorithm in response to offloading the servicerequest.

Example 57 includes the subject matter of any of Examples 48-56, andwherein the means for performing the primitive task comprises means forperforming a cryptographic mathematical primitive operation.

Example 58 includes the subject matter of any of Examples 48-57, andwherein the means for performing the primitive task comprises means forperforming a modular exponentiation operation.

Example 59 includes the subject matter of any of Examples 48-58, andwherein the means for performing the primitive task comprises means forperforming a modular multiplicative inverse operation.

Example 60 includes the subject matter of any of Examples 48-59, andwherein the means for performing the primitive task comprises means forperforming a modular multiplication operation.

Example 61 includes the subject matter of any of Examples 48-60, andwherein the means for performing the primitive task comprises means forperforming an elliptic curve operation.

Example 62 includes the subject matter of any of Examples 48-61, andwherein the means for performing the primitive task comprises means forperforming a signal processing operation.

Example 63 includes the subject matter of any of Examples 48-62, andwherein the means for performing the primitive task comprises means forperforming a fast Fourier transform operation.

Example 64 includes the subject matter of any of Examples 48-63, andwherein the means for performing the primitive task comprises means forperforming a zero-knowledge proof operation.

Example 65 includes the subject matter of any of Examples 48-64, andwherein the means for performing the primitive ask comprises means forperforming a digital random number generation operation.

Example 66 includes the subject matter of any of Examples 48-65, andfurther comprising means for load-balancing, by the FGPA, a pluralityprimitive tasks among a plurality of bit streams of the ASIC, hereineach bit stream of the ASIC is configured to perform the primitive task.

Example 67 includes the subject matter of any of Examples 48-66, andfurther comprising: means for determining, by the FPGA, whether theplurality of bit streams of the ASIC are unavailable; and means forperforming, by the FGPA, the primitive task in response to determiningthat the plurality of bit streams of the ASIC are unavailable.

Example 68 includes the subject matter of any of Examples 48-67, andwherein the means for returning the one or more results of the service,request comprises means for returning the results from the FPGA to aprocessor of the computing device.

Example 69 includes the subject matter of any of Examples 48-68, andwherein the means for returning the one or more results of the servicerequest comprises means for forwarding the results from the FPGA to anetwork interface controller of the computing device.

The invention claimed is:
 1. A computing device comprising: afield-programmable gate array (FPGA); an application-specific integratedcircuit (ASIC); and an offload manager to offload a service request tothe FPGA of the computing device; wherein the FPGA comprises: algorithmcircuitry to perform one or more algorithm tasks of an algorithm toperform the service request and determine a primitive task associatedwith an algorithm task of the one or more algorithm tasks; primitiveoffload circuitry to encapsulate the primitive task in a buffer of theFPGA, wherein the buffer is accessible by the ASIC of the computingdevice; and result circuitry to return one or more results of theservice request in response to performance of the primitive task by theASIC.
 2. The computing device of claim 1, wherein the service requestcomprises a cryptographic service request and the algorithm comprises acryptographic algorithm.
 3. The computing device of claim 1, wherein theservice request comprises a packet processing service request and thealgorithm comprises a packet processing algorithm.
 4. The computingdevice of claim 1, wherein to offload the service request comprises tooffload the service request from a processor of the computing device tothe FPGA.
 5. The computing device of claim 1, wherein to offload theservice request comprises to offload the service request from a networkinterface controller of the computing device to the FPGA.
 6. Thecomputing device of claim 1, wherein the algorithm circuitry is furtherto determine the one or more algorithm tasks of the algorithm inresponse to the offload of the service request.
 7. The computing deviceof claim 1, wherein the ASIC comprises primitive circuitry to performthe primitive task in response to encapsulation of the primitive task,and wherein to perform the primitive task comprises to perform acryptographic mathematical primitive operation.
 8. The computing deviceof claim 1, wherein the ASIC comprises primitive circuitry to performthe primitive task in response to encapsulation of the primitive task,and wherein to perform the primitive task comprises to perform a signalprocessing operation.
 9. The computing device of claim 1, wherein theASIC comprises primitive circuitry to perform the primitive task inresponse to encapsulation of the primitive task, and wherein: theprimitive circuitry of the ASIC comprises a plurality of bit streams,wherein each bit stream is configured to perform the primitive task; andthe primitive offload logic of the FPGA is to load-balance a pluralityof primitive tasks among the plurality of bit streams of the ASIC. 10.The computing device of claim 1, wherein to return the one or moreresults of the service request comprises to return the results from theFPGA to a processor of the computing device.
 11. The computing device ofclaim 1, wherein to return the one or more results of the servicerequest comprises to forward the results from the FPGA to a networkinterface controller of the computing device.
 12. A method comprising:offloading, by a computing device, a service request to afield-programmable gate array (FPGA) of the computing device;performing, by the FPGA of the computing device, one or more algorithmtasks of an algorithm to perform the service request; determining, bythe FPGA of the computing device, a primitive task associated with analgorithm task; encapsulating, by the FPGA of the computing device, theprimitive task in a buffer of the FPGA, wherein the buffer is accessibleby an application-specific integrated circuit (ASIC) of the computingdevice; and returning, by the FPGA, one or more results of the servicerequest in response to the ASIC performing the primitive task.
 13. Themethod of claim 12, wherein the service request comprises acryptographic service request and the algorithm comprises acryptographic algorithm.
 14. The method of claim 12, wherein the servicerequest comprises a packet processing service request and the algorithmcomprises a packet processing algorithm.
 15. The method of claim 12,further comprising determining, by the FPGA of the computing device, theone or more algorithm tasks of the algorithm in response to offloadingthe service request.
 16. The method of claim 12, wherein the ASIC toperform the primitive task comprises performing a cryptographicmathematical primitive operation.
 17. The method of claim 12, whereinthe ASIC to perform the primitive task comprises performing a signalprocessing operation.
 18. The method of claim 12, further comprisingload-balancing, by the FGPA, a plurality of primitive tasks among aplurality of bit streams of the ASIC, wherein each bit stream of theASIC is configured to perform the primitive task.
 19. A non-transitorycomputer-readable storage media comprising a plurality of instructionsthat in response to being executed cause a computing device to:offloading, by the computing device, a service request to afield-programmable gate array (FPGA) of the computing device;performing, by the FPGA of the computing device, one or more algorithmtasks of an algorithm to perform the service request; determining, bythe FPGA of the computing device, a primitive task associated with analgorithm task; encapsulating, by the FPGA of the computing device, theprimitive task in a buffer of the FPGA, wherein the buffer is accessibleby an application-specific integrated circuit (ASIC) of the computingdevice; and returning, by the FPGA, one or more results of the servicerequest in response to the ASIC performing the primitive task.
 20. Thenon-transitory computer-readable storage media of claim 19, wherein theservice request comprises a cryptographic service request and thealgorithm comprises a cryptographic algorithm.